781c47d991ce9995fe610dcd9625eebbd388ce75937d7eed13aadd40dcdc5e72N

Sharing

Copy URL Twitter E-mail

General

Target

781c47d991ce9995fe610dcd9625eebbd388ce75937d7eed13aadd40dcdc5e72N
Size

699KB
MD5

516b6209ff8137e93ff00e0c06d001c0
SHA1

1f7705448222d0b937f9caf5a3ff6c1d99f61066
SHA256

781c47d991ce9995fe610dcd9625eebbd388ce75937d7eed13aadd40dcdc5e72
SHA512

2dc0b68545bc72f8b3e72b3c8df2c03e6c8bcd356a82e917a196e1242af16c909904fcd981f6bcd1b85a3f97607de84a5a86778610a11dea17468d410003a079
SSDEEP

12288:RGGzJN9y9W5B40vjwrrT1uGUaLXwCi1cd5+26Emd/25TR4++dV0HImRy3Gh8qfl0:RGGVPy9W5B40vUrAJSwCi1rx4t4T0wcu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
781c47d991ce9995fe610dcd9625eebbd388ce75937d7eed13aadd40dcdc5e72N

Files

781c47d991ce9995fe610dcd9625eebbd388ce75937d7eed13aadd40dcdc5e72N
.dll windows:4 windows x86 arch:x86

934b7678e4ff755906db4e10dfa5a8ec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenPrivileges
CloseEncryptedFileRaw
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
ReadEncryptedFileRaw
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegLoadKeyW
RegSetValueExW
RegUnLoadKeyW
WriteEncryptedFileRaw

kernel32

CloseHandle
CreateEventA
CreateFileW
CreateSemaphoreA
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageW
FreeLibrary
GetACP
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetHandleInformation
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
GetTimeZoneInformation
GetVersionExA
GetVolumeInformationW
GlobalMemoryStatusEx
HeapFree
InitializeCriticalSection
IsDBCSLeadByteEx
IsValidCodePage
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MoveFileExW
MoveFileW
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
ReleaseSemaphore
ResetEvent
ResumeThread
SetEndOfFile
SetEvent
SetFilePointer
SetFilePointerEx
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

__dllonexit
__mb_cur_max
_amsg_exit
_beginthreadex
_endthreadex
_errno
_exit
_fstati64
_get_osfhandle
_initterm
_iob
_lock
_lseeki64
_onexit
_open_osfhandle
_setjmp3
_snwprintf
_stat
_wstati64
time
gmtime
_stricmp
_strnicmp
_telli64
calloc
exit
fclose
ferror
fflush
fopen
fprintf
fputc
fputs
fputwc
fputws
fread
free
fwprintf
fwrite
getenv
islower
isspace
isupper
iswctype
localeconv
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
printf
putc
qsort
raise
rand
realloc
setlocale
srand
sscanf
strcat
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
_unlock
_waccess
_wcsicmp
_wfopen
_wmkdir
_wopen
_wstat
_wtempnam
_wunlink
abort
atoi
toupper
towlower
vfprintf
wcschr
wcscmp
wcscpy
wcsftime
wcslen
wcsncmp
wcspbrk
wcsrchr
wcsstr
wcstol
_vsnprintf
longjmp
_write
_read
_getcwd
_fdopen
_close

user32

MessageBoxW
wsprintfW

Exports

Exports

wimlib_add_empty_image
wimlib_add_image
wimlib_add_image_multisource
wimlib_add_tree
wimlib_compress
wimlib_create_compressor
wimlib_create_decompressor
wimlib_create_new_wim
wimlib_decompress
wimlib_delete_image
wimlib_delete_path
wimlib_export_image
wimlib_extract_image
wimlib_extract_image_from_pipe
wimlib_extract_image_from_pipe_with_progress
wimlib_extract_pathlist
wimlib_extract_paths
wimlib_extract_xml_data
wimlib_free
wimlib_free_compressor
wimlib_free_decompressor
wimlib_get_compression_type_string
wimlib_get_compressor_needed_memory
wimlib_get_error_string
wimlib_get_image_description
wimlib_get_image_name
wimlib_get_version
wimlib_get_wim_info
wimlib_get_xml_data
wimlib_global_cleanup
wimlib_global_init
wimlib_image_name_in_use
wimlib_iterate_dir_tree
wimlib_iterate_lookup_table
wimlib_join
wimlib_join_with_progress
wimlib_mount_image
wimlib_open_wim
wimlib_open_wim_with_progress
wimlib_overwrite
wimlib_print_available_images
wimlib_print_header
wimlib_reference_resource_files
wimlib_reference_resources
wimlib_reference_template_image
wimlib_register_progress_function
wimlib_rename_path
wimlib_resolve_image
wimlib_set_default_compression_level
wimlib_set_error_file
wimlib_set_error_file_by_name
wimlib_set_image_descripton
wimlib_set_image_flags
wimlib_set_image_name
wimlib_set_memory_allocator
wimlib_set_output_chunk_size
wimlib_set_output_compression_type
wimlib_set_output_pack_chunk_size
wimlib_set_output_pack_compression_type
wimlib_set_print_errors
wimlib_set_wim_info
wimlib_split
wimlib_unmount_image
wimlib_unmount_image_with_progress
wimlib_update_image
wimlib_verify_wim
wimlib_write
wimlib_write_to_fd

Sections

.text
Size: 493KB - Virtual size: 493KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

934b7678e4ff755906db4e10dfa5a8ec

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

Exports

Exports

Sections

.text Size: 493KB - Virtual size: 493KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 104KB - Virtual size: 104KB

.bss Size: - Virtual size: 132KB

.edata Size: 2KB - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 48B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 493KB - Virtual size: 493KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 104KB - Virtual size: 104KB

.bss
Size: - Virtual size: 132KB

.edata
Size: 2KB - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 48B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 13KB - Virtual size: 13KB